{"cve":"CVE-2026-101056","nvd":{"published":"2026-09-27T18:16:31.667","modified":"2026-10-08T16:17:01.093","status":"Deferred","description":"Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-863"],"references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w","https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-authentication-bypass-via-cached-context-hint"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:48.555445741+00:00"},"epss":{"cve":"CVE-2026-101056","score":0.00195,"percentile":0.09056,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-vx2m-jpxr-xv7w","url":"https://osv.dev/vulnerability/GHSA-vx2m-jpxr-xv7w","summary":"Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint","modified":"2026-09-28T03:55:38.183380212Z","packages":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v4","ranges":["<=4.0.0-20260606032813-26b6b1044b02"],"fixed":[]}]},{"id":"GO-2026-6287","url":"https://osv.dev/vulnerability/GO-2026-6287","summary":"Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/cloudreve/Cloudreve","modified":"2026-09-28T03:55:38.183380212Z","packages":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve","purl":"pkg:golang/github.com/cloudreve/Cloudreve","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v3","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v4","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}